Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

B410: lxml.cssselect has no equivalent in defusedxml #716

Closed
icemac opened this issue Jun 21, 2021 · 1 comment
Closed

B410: lxml.cssselect has no equivalent in defusedxml #716

icemac opened this issue Jun 21, 2021 · 1 comment
Labels
bug Something isn't working

Comments

@icemac
Copy link

icemac commented Jun 21, 2021

Describe the bug
The message for B410 ("Using lxml.cssselect to parse untrusted XML data is known to be vulnerable to XML attacks. Replace lxml.cssselect with the equivalent defusedxml package.") is misleading: There is no equivalent in the defusedxml package. According to https://github.com/tiran/defusedxml/blob/9ca12a2cd3faf4554b30ac7d380a4ea393469c72/defusedxml/lxml.py#L26-L29 defusedxml.lxml is deprecated and to be be removed.

To Reproduce
Steps to reproduce the behavior:

  1. Have a Python module containing import lxml.cssselect.
  2. Run bandit on it
  3. See error message

Expected behavior
No message should be shown.

Bandit version

bandit 1.7.0
  python version = 3.8.10 (default, May  7 2021, 21:09:28) [Clang 12.0.5 (clang-1205.0.22.9)]
@icemac icemac added the bug Something isn't working label Jun 21, 2021
@ericwb
Copy link
Member

ericwb commented Jan 11, 2025

The rule B410 has been removed in PR #1212. Therefore this should no longer be an issue.

@ericwb ericwb closed this as completed Jan 11, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working
Projects
None yet
Development

No branches or pull requests

2 participants